On Thu, 11 Feb 2016 10:39:53 +0000, Stuart Henderson wrote: > I updated some firewalls to -current yesterday (from somewhere between > 5.6 and 5.7) and am now seeing a lot of "arp: attempt to add entry" > logged, see below. (Looks like someone has put a machine on the wrong > vlan and it's sending out broadcast arp replies for conflict detection > which are triggering the logs, anyway that's a different problem). > > Some of the lines in the logged file get split in half. I'm thinking > this probably warrants further investigation as it could cause log > monitoring programs to not notice certain problems..
That's really weird. The /dev/klog fd in syslogd isn't opened non-blocking and from what I understand, log messages from the kernel shouldn't be seen from userland until logwakeup() is called at the end up the message. Can you try disabling kqueue in syslogd by setting EVENT_NOKQUEUE=1 and see if the behavior changes? - todd
